The answer in three lines
- A cryptocurrency is an entry on a shared ledger; whoever controls the private key controls the coins recorded against an address.
- Sending crypto means broadcasting a signed instruction and paying a network fee; once confirmed, it cannot be reversed by anyone.
- On an exchange you usually hold a claim on the platform rather than the coins themselves, which trades one set of risks for another.
How crypto works is easiest to understand if you ignore prices for a moment. A cryptocurrency is a record in a ledger that thousands of independent computers keep in agreement. Nobody owns the ledger, nobody can edit it alone, and the only way to move an entry is to prove, with a private key, that you control it. The rest of this guide builds on that one mechanism.
What is a blockchain doing, exactly?
Keeping a public list of transactions that everyone can check and nobody can quietly change.
Transactions are grouped into blocks, and each block contains a fingerprint (a hash) of the one before it. Changing an old transaction would change its block's fingerprint, which would break every block after it. The network's rules for adding blocks, proof of work in Bitcoin's case and proof of stake on Ethereum, make rewriting history either very expensive or very easy to detect. The Bitcoin guide describes mining in more detail.
What are keys, addresses and wallets?
A private key is the secret that authorises spending; an address is the public label derived from it; a wallet is software that manages keys.
Your coins are never inside the wallet app. They exist as ledger entries tied to addresses, and the wallet holds the keys that can sign transactions for those addresses. Most wallets generate the keys from a recovery phrase of 12 or 24 words. Anyone who learns that phrase can take everything, from anywhere, without your knowledge, and nobody can reverse it. That is why no legitimate service, support agent or website, including this one, will ever ask for it.
- Self-custody: you hold the keys. No platform can freeze or lose your coins, but loss of the phrase or a signed malicious approval is permanent.
- Custodial: a platform holds the keys, and your balance is a number in its database. Convenient and recoverable if you forget a password, but you depend on the platform staying solvent and honest.
What happens when you send crypto?
Your wallet signs an instruction, broadcasts it, and the network includes it in a block in exchange for a fee.
- You enter the recipient address, the amount and, where relevant, the network.
- The wallet signs the transaction with your private key and sends it to the network.
- Validators or miners pick transactions to include, generally favouring those paying higher fees when blocks are full.
- Once included, the transaction gains confirmations as further blocks are added on top. Platforms wait for a set number before crediting a deposit.
Network fees are set by demand for block space, not by the amount you send. That makes them trivial on large transfers and painful on small ones. As an illustration, a $1.50 fee is 3% of a $50 transfer but only 0.03% of a $5,000 transfer.
Are all crypto-assets the same kind of thing?
No. Native coins, tokens and stablecoins behave very differently.
Native coins such as bitcoin and ether are built into their networks and pay the network's fees. Tokens are issued by smart contracts on top of a network: governance tokens, in-app currencies, wrapped versions of other assets. Their value depends heavily on the project behind them, and many have gone to zero. Stablecoins aim to track a currency, usually the US dollar, by holding reserves or through other mechanisms. The largest, USDT, is issued on several networks at once, which is why choosing the network correctly matters.
How do crypto payments work in practice?
Either directly between wallets, or through a payment processor that converts crypto into ordinary money for the merchant.
A direct payment is just a transfer: the payer sends coins to an address the merchant provides, often via a QR code that fixes the amount and network. More commonly, merchants use a processor that quotes a crypto price for a short window, receives the coins and settles the merchant in local currency, so the merchant carries no price risk. Stablecoins are popular for crypto payments precisely because a dollar-linked token avoids the problem of the price moving between invoice and payment.
Three practical points follow. First, there is no chargeback: a buyer cannot reverse a payment the way a card payment can be disputed, which shifts trust onto the merchant. Second, fees and confirmation times depend on the network chosen. Third, spending crypto can be a taxable disposal in many countries, so a coffee paid in bitcoin may create a record-keeping obligation.
Where do smart contracts and DeFi fit in?
Smart contracts are programs stored on a blockchain; decentralised finance (DeFi) uses them to run trading, lending and borrowing without a company in the middle.
On networks such as Ethereum, anyone can deploy code that holds tokens and follows fixed rules: swap token A for token B at a formula-based price, lend deposits to borrowers who post collateral, and so on. You interact by connecting a self-custody wallet and signing transactions. The appeal is transparency and access; the risks are different from a platform's. A bug in the code can be exploited and drain the funds, prices in thin pools can be manipulated, and a single careless approval can let a malicious contract move your tokens. There is usually no support desk and no one to reverse a mistake.
What does a sensible security setup look like?
Separate your keys from your everyday devices, secure your accounts with app-based two-factor codes, and slow down before signing anything.
- Write the recovery phrase on paper or metal, store it offline, and never photograph it or type it into a website.
- Use a hardware wallet for larger balances, and a separate hot wallet with small amounts for experiments.
- Protect platform accounts with an authenticator app rather than SMS codes, and use a unique password for each.
- Reach platforms through saved bookmarks rather than search adverts or links in messages.
- Review and revoke token approvals you no longer need.
- Keep a written record of which platforms and wallets you use, so that someone you trust could find them in an emergency without needing your keys.
How crypto works inside an exchange, compared with a wallet
Inside an exchange, trades are just database entries; the blockchain is only used when coins enter or leave.
When you buy bitcoin on a centralised exchange, no coins move on-chain. The exchange updates its internal records, and the coins sit in wallets it controls, often pooled with other customers' holdings. That makes trading instant and cheap, but your position depends on the exchange's solvency and record-keeping. Several large platforms have failed in the past with customer assets missing, and customers waited years for partial recoveries. Our platform checklist covers custody, reserves and withdrawals, and the comparison table on the home page summarises what to ask.
What are the main risks, ranked by how often they bite?
- Scams and social engineering: fake apps, impersonators and investment groups. See how to spot trading scams.
- Volatility: falls of more than half from a peak have happened repeatedly, even for the largest coins.
- Operational mistakes: wrong address, wrong network, lost recovery phrase.
- Platform failure: insolvency, hacks or frozen withdrawals at a custodial service.
- Leverage: derivatives with high leverage can liquidate a position on an ordinary daily move. Retail sale of crypto derivatives is banned in the UK, and retail crypto CFDs are capped at 2:1 in the EU.
- Regulatory change: rules on stablecoins, exchanges and taxes are still evolving and differ by country.
Follow-up questions
If a blockchain is public, is crypto anonymous?
Usually not. Most blockchains are pseudonymous: addresses are not names, but every transaction is public, and exchanges link addresses to verified identities. Analysis firms and investigators routinely trace funds across addresses.
Can a lost recovery phrase be recovered?
No. Without the phrase or a backup of the keys, nobody can restore access, including the wallet's developers. Anyone offering to recover coins for an upfront fee is almost certainly running a scam.
Why did my deposit take so long to appear?
Platforms wait for a set number of confirmations before crediting deposits, and busy networks can delay inclusion if the fee paid was low. Check the transaction ID on a block explorer to see its status.
Sources
- UK Financial Conduct Authority, ban on crypto-derivatives for retail consumers
- European Securities and Markets Authority, product intervention measures on CFDs
- Bitcoin and Ethereum protocol documentation